Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2025-03-22...ys.exe

windows7-x64

10

2025-03-22...ys.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 21:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

  • Size

    1.9MB

  • MD5

    11440d40b4dcfc3cf8383f9097433bb8

  • SHA1

    f0f69363ebceee5c5945f44867ab7feb7ea2f57b

  • SHA256

    377031a94559fef772cda1593232a3b2c7fa6ac7ec57dc44a37cacef3cfa2c06

  • SHA512

    36c10cdcd318638aab437a4bdd9e3088d5194dea1359786a960f1d595727f734349104c02cd5fab5258d95591a990ef9e1ec113958e1c81f27eff020b1f1feeb

  • SSDEEP

    24576:87ZGy9+Acpjdv+K3eqA6dj6YU1s20UPxXMP2Wk4AX:+/Sp5AyAXtWk1

Score
10/10
ramnitbankerdiscoveryspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Ramnit family
    ramnit
  • Drops file in Drivers directory 2 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 25 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 38 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5660
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5660 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4540
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5796
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{08eda411-1f88-644d-ad89-069304ee49d0}\Rockey4.inf" "9" "4281a14cb" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Windows\Temp"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{f028d511-be72-324a-a31a-74d8ea8b3d2e} Global\{a61b6066-5c08-8247-9615-878915549820} C:\Windows\System32\DriverStore\Temp\{77d0a9e3-7ad0-4841-908f-b17dc318b41c}\Rockey4.inf C:\Windows\System32\DriverStore\Temp\{77d0a9e3-7ad0-4841-908f-b17dc318b41c}\Rockey4.cat
        3⤵
          PID:3268

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
      Filesize

      471B

      MD5

      01fa3211165ca3e0dbd816e5389630bf

      SHA1

      2a6569707c8ea29cbf996a906855470bb7831f48

      SHA256

      ab165a9a5b25e6c05f6f2eac77c9dcc9b4157897524a0be4415cdae9cef5636f

      SHA512

      1848c476ebf00781299715f7c664465a071fa54e3bc14002df35a74aa27667788956bddc4b96b241ea2865f819cf5e33ed7907504a99342c2a0379a0964550ad

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
      Filesize

      412B

      MD5

      bb5ab3850e2fa2f5c0b92e8b87ddf1f8

      SHA1

      d0911d17d6da37c2ce8f00688fd5703b47b13068

      SHA256

      1a55e990fda31429f51561588d87fa00d8d0436d5a3a370f5c939f520c661b69

      SHA512

      529398574099ef6f57e8f9833df2076aa1b05f3b8d78d7401f16a21dc9332f4ef824343392256a4eb469013d99aad9ba16f55001fef593ff9e4e3c37c79564c3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OMQG84ST\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

      Download Submit

    • C:\Windows\SysWOW64\InstDll.dll
      Filesize

      412KB

      MD5

      28777af4daf84f9ad4145f7105e02477

      SHA1

      f2100f4812007a253134d4e134e6208a78263a2c

      SHA256

      7e0f6280add4c6000d6bf548402e849b83047b960ad89be067ae87e4dc103b77

      SHA512

      543e81509693ed6b75f9dbce536ab15f1bcac5f1fc71646b53ac2bafd2af5859add9acf21b247719e2cf6d2974c3c8552a1fb2f13d3f3be428099fc62e62dcad

      Download Submit

    • C:\Windows\Temp\Rockey4.inf
      Filesize

      3KB

      MD5

      3ce2e5aeef01fa93d94868953406856b

      SHA1

      10d56292d022f39d8ceefded624f8522f5bdccfd

      SHA256

      8cf87f05e75dd558eac842ea3eeda9cafe675d4c6d1eaa211c403b7de2e599cb

      SHA512

      ffeb48efa4254d11d398eb6197ec1a8c0ae398d0bd3dd1cd7d3f66fd8f8e252e726b8adcf651c6e2f2bd9a78023151ca2103349bb63f788aef306010f6f983fc

      Download Submit

    • C:\Windows\Temp\Rockey4.sys
      Filesize

      29KB

      MD5

      6b9b088f4921b5114f7916a1cfa90f51

      SHA1

      be3d21cf1a9eae23ff0464f2ee19d60891ba8777

      SHA256

      a3fbfe4c4c5195524107d1127e8165d53319f306e07647022a6557750f0b2c29

      SHA512

      961c9e56bb62098989d55a951da4b05db56d15ca26ca85f9413139f24ae3624056c33d16d711819f1cac97469fa456578fedcd30dde773d87523a29cb337a98d

      Download Submit

    • C:\Windows\Temp\Rockey4USB.sys
      Filesize

      20KB

      MD5

      a215e31da7fc0369e315132303582b5b

      SHA1

      3dbb87e75c01ad93845a6c90602bdcd49f5e1882

      SHA256

      a55c1b52240efb612b0771f35797f2aa68b249be7f7da930a0ee5d8212c7f7a7

      SHA512

      c5d132725c3f41357b517341a28220cf205cba4c49376908b03e8780c6c456db70724f48b3ce89f90edb9e865308a607a41db0571e8e871c503e0ff251ce76a2

      Download Submit

    • C:\Windows\Temp\Ry4CoInst.dll
      Filesize

      6KB

      MD5

      5d1e774106c240e330e7384f8bd2835c

      SHA1

      0e6bfc62067d52540eb84852eb1e160fb646e4d5

      SHA256

      fab2055534c54c8c8d3df3065a481fb8b2d1bc052c29ac500634ba63f32fea09

      SHA512

      48c4d2ac25e8e3f128201cc0503de7cdb952ad849fe760c112bf32ff0e9df96da16fa356ab99f64cb45eb3a4314fc3bfdc852e06a1263c4cd681c7b42b9df578

      Download Submit

    • C:\Windows\Temp\rockey4.cat
      Filesize

      9KB

      MD5

      f5e17a72ecbe8f0556423e796124f785

      SHA1

      60b887c365c0541e0aa1518ac687bc3eb7e60a4c

      SHA256

      d0e390cbe3a1313d0b4348bfdc9da947616fc7dda4ecc414468b5f2151f5b60f

      SHA512

      4f85087d92b2b6494cb2a1d281c34bb72fa6bd9f31d3369aa9729ba12d320618836f2d25dc92dcec18b1c9cfa0f3977bff809d179a988ddacaf67acfe06ea9c4

      Download Submit

    • memory/404-0-0x0000000000400000-0x00000000005F5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/404-22-0x0000000000400000-0x00000000005F5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1012-18-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1012-21-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/1012-19-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/1572-10-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/1572-6-0x0000000000590000-0x000000000059F000-memory.dmp

      Filesize

      60KB

      Download

    • memory/1572-4-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download